release.yml RawHistoryFolder

1name: Release
2on:
3  push:
4    tags: ['v*']
5permissions:
6  contents: read
7concurrency:
8  group: release-${{ github.ref }}
9  cancel-in-progress: false
10jobs:
11  # Releases are published by ermite (git.bnema.dev); the GitHub mirror
12  # receives the tags but must not publish a second release or AUR push.
13  check:
14    if: github.server_url != 'https://github.com'
15    uses: ./.github/workflows/ci.yml
16
17  release:
18    needs: check
19    runs-on: ubuntu-latest
20    permissions:
21      contents: write     # create the release
22    steps:
23      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24        with:
25          fetch-depth: 0
26          persist-credentials: false
27      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
28        with:
29          go-version-file: go.mod
30      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
31        with:
32          distribution: goreleaser
33          version: '~> v2'
34          # Snapshot first: the .deb is installed on Ubuntu before anything ships.
35          args: release --snapshot --clean --skip=aur
36      - name: Smoke-test the .deb on Ubuntu LTS
37        run: |
38          for v in 24.04 26.04; do
39            packaging/deb/smoke-test.sh "$v" dist/neferwl_*_amd64.deb
40          done
41      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
42        with:
43          distribution: goreleaser
44          version: '~> v2'
45          args: release --clean
46        env:
47          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
49        with:
50          name: aur-bin
51          path: dist/aur/neferwl-bin.pkgbuild
52          if-no-files-found: error
53
54  # makepkg must run on Arch as a non-root user. publish.sh builds each
55  # package, verifies every source checksum, then pushes it.
56  aur:
57    needs: release
58    runs-on: ubuntu-latest
59    container:
60      image: archlinux:latest
61    strategy:
62      fail-fast: false
63      matrix:
64        pkg: [neferwl-bin, neferwl-git]
65    # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
66    # after 0.2.0, so the final release would not look like an upgrade.
67    env:
68      SKIP: ${{ contains(github.ref_name, '-') }}
69    steps:
70      - run: >-
71          pacman -Syu --noconfirm --needed
72          base-devel git openssh sudo
73      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
74        with:
75          persist-credentials: false
76      - if: matrix.pkg == 'neferwl-bin' && env.SKIP != 'true'
77        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
78        with:
79          name: aur-bin
80          path: aur-bin
81      - name: Create the build user
82        run: |
83          useradd -m builder
84          echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
85      - name: Build, verify and publish ${{ matrix.pkg }}
86        if: env.SKIP != 'true'
87        env:
88          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
89          AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
90          AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
91          PKG: ${{ matrix.pkg }}
92        run: |
93          if [ "$PKG" = neferwl-bin ]; then
94            pkgbuild=aur-bin/neferwl-bin.pkgbuild
95          else
96            pkgbuild=packaging/aur/neferwl-git/PKGBUILD
97          fi
98          chmod -R a+rX "$GITHUB_WORKSPACE"
99          sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
100            packaging/aur/publish.sh "$PKG" "$pkgbuild"